Slashdot Mirror

← Back to Stories (view on slashdot.org)

Ask Slashdot: How Serious Is Hacking In Mobile Games?

Posted by Soulskill on from the going-for-the-high-score dept.

Origen writes: As a developer contemplating trying out the mobile game scene, a GDC session about hacking/tampering looked interesting — but I wasn't able to attend. The presentation isn't available online, but it was paired with a whitepaper [contact details required], which can be downloaded. I'm surprised by some of the information presented and the potential for damage/mischief. Not so much that these issues are unheard of — they've existed for years on other platforms. What I find surprising is the lack of support at the OS level on mobile devices to defend from many of these types of hacks. Have we learned nothing from the pains of the past? How significant are the points about hacking/piracy in the mobile space that are discussed by this whitepaper?

86 comments

  1. I don't know about mobile games by Anonymous Coward · · Score: 0

    I don't know about mobile games but I remember Super Meat Boy made an actual connection to the high scores database from the game client, this was very quickly abused for 0.00 times.

    The things people do to cut corners sometimes is amazing.

    1. Re:I don't know about mobile games by Anonymous Coward · · Score: 0

      Out of interest does anybody know how cheat detection for such a game (where speed is essential for game play but network speed is limited) should be done? I mean for some games you can might be able to use the client for input capture (e.g.: motion events), process it on your server and send back positions for game elements but on a mobile platform where many people have high latency (3-5 seconds is common in the city on 3g)...

  2. If you don't control it it's compromised. by Anonymous Coward · · Score: 2, Informative

    OS level protection wouldn't do much if someone's really dedicated, they'll just remove those protections if needed. Assume everything coming through an internet connection is compromised, don't trust your game client.

    1. Re:If you don't control it it's compromised. by gl4ss · · Score: 1

      besides,

      the key is to not trust the client. for highscores/top-times, run a simulation of the game run on the server from the inputs.

      for ingame bought stuff, there is protections. you can check on your server if the player actually paid for the stuff. or you can skip that check and lose money.

      you cannot trust the client - I mean, what the fuck are the protections on the "os" going to do when the game might not even be running on the target os! I mean, the client might be an entirely different program!

      --
      world was created 5 seconds before this post as it is.
    2. Re:If you don't control it it's compromised. by rioki · · Score: 5, Interesting

      I would simply take the same approach you should take with PC games. If it's single player, don't bother. You are wasting resources, resources you can use to make your game just a little more awesome. (more awesome == more sales) Wit multiplayer games, the key point is the server. The server should not trust clients and use heuristics to detect suspicious behavior. Then give administrators the means to moderate their users. (Or a vote system.) Bad behavior is a real issue with multiplayer games, but that is not limited to cheating.

      But since we are talking about mobile games; are users cheating you on the premium currency? Treat is like any other piracy, ignore it and try to win users by making the cooler more awesome game. Maybe communicate that you are an independent developer and need the money to make games.

    3. Re:If you don't control it it's compromised. by wonkey_monkey · · Score: 4, Interesting

      the key is to not trust the client. for highscores/top-times, run a simulation of the game run on the server from the inputs.

      How do you know you can trust the reported inputs? And you can't run a simulation if your game has (truly) random elements, nor can you allow for all device idiosyncracies.

      Now if you'll excuse me, I need to continue work on my Arduino-controlled Wiimote holder so I can finally get a perfect game on Bit.trip Beat.

      --
      systemd is Roko's Basilisk.
    4. Re:If you don't control it it's compromised. by Anonymous Coward · · Score: 0

      There is no such thing as 'truly' random element in video games. What you call 'truly random' is just seeded with the data/time of day.

      All you need to do is send the seed that was used along the input to make replay and validate the time/score/etc. Also other users can watch the replay from the input and flag suspicious feat as cheat, which can then receive extra attention from the developer of they care about cheating at all. None is this is particularly hard. Event logs and replay are common since at least the original doom or quake. They were use for debugging, demo loop and benchmarking.

    5. Re:If you don't control it it's compromised. by Anonymous Coward · · Score: 0

      the key is to not trust the client. for highscores/top-times, run a simulation of the game run on the server from the inputs.

      How do you know you can trust the reported inputs?

      It could be a tool-assisted speedrun of sorts, but these are so incredibly labor intensive that it is not worth worrying about.

    6. Re:If you don't control it it's compromised. by hairyfeet · · Score: 1

      Seems to be working just fine in the PC market, but of course there you have programs like Punkbuster and Steam that are pretty quick at shutting down the cheaters.

      The problem is that mobile OSes are a good 10-15 years behind desktops which is why iOS had more vulnerabilities than Linux and Windows, the mobile OSes are really still in their infancy and just haven't caught up yet and with so many trying to hack them (for good and ill) its gonna take awhile to catch up. I'm sure eventually you'll have something like Punkbuster or some other anti-gamehack program for phones but until then all you can really do is look at the player as a potential bad guy.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    7. Re:If you don't control it it's compromised. by jandrese · · Score: 1

      Even a simulation of the inputs won't prevent all cheating. What if someone has an x-ray hack in place, and maybe even a bot attached that can play a perfect game? The best solution is to just not give a crap and not have online leaderboards or IAP so the only people affected by the hacking are the hackers themselves.

      PvP is a problem though. There's not a lot you can do to prevent some forms of cheating in PvP, but on the mobile space PvP isn't nearly as important anyway. Usually it boils down to "user A submits an army list to the server, user B submits an army list to the server, the server simulates a battle, and then returns the results to both players". As long as your game isn't structured like a CCG with overpowered "rare" units that are supposed to be balanced by being difficult to get (or requiring real money) then it's not so bad. The cheater can submit an optimal army without having to grind, but otherwise they aren't ruining the game for other people too much.

      --

      I read the internet for the articles.
    8. Re:If you don't control it it's compromised. by mlts · · Score: 1

      For real security, the client should just be "eyes/ears" for the server, similar to how MMOs are. This was true back in the UO days, and is true now.

      At least phones and mobile devices are easier to track and ban cheaters because you can ban an account and if any new accounts touch that device's IMEI, they get auto-banned after a random period of time as well. A simple check for a su binary on Android or a check if one can write outside the app's directory in iOS will deal with rooted/jailbroken devices.

      Another trick is to update often, preferably with completely different offsets for code and/or obfuscation algorithms so if a group is making patches for the game, they would have to be constantly after a moving target, even if the update just changes a constant or two.

    9. Re:If you don't control it it's compromised. by Anonymous Coward · · Score: 0

      I'd probably have separate scenarios:

      Single player, unrated. This is for making custom mods, custom levels, and general tinkering around. All stuff is done on the client, and the OS's antipiracy measures are sufficient, be it LVL or Apple's (as there is no JB for 8.2, and looks like there won't be one on the horizon.)

      Single player, rated. I'd have some integrity checks, perhaps try to move as much of it to the server as possible. With this model, one not just has to rely on LVL, but have an ever-changing anti-hack daemon, and be ready to take action on accounts, IMEIs, and other phone IDs. It could be overt action like a ban on the account, or quietly just not having someone's score updated. You can add GPS tracking info and a $10,000 fine for cheating in the EULA (which can easily be enforced), which will go far into running off all non-overseas hackers.

      Multiplayer. This needs the most protection, and as stated above, it needs a good anti-cheat means, or else people will leave the game in droves once the "toolz/trainerz" start being sold.

      As for piracy, if a game uses a premium currency, it should be completely server based. Otherwise, it will get grossly exploited, especially in PvP scenarios. Realistically a premium currency shouldn't be used, and IAP should be more about additional game content, rather than carts of blarfberries.

    10. Re:If you don't control it it's compromised. by Anubis+IV · · Score: 1

      At least the first level of Bit.Trip Beat is pretty easy (I've nearly had perfect scores on multiple occasions, having made it through the toughest parts and then missing easy ones late in the level, all while only playing it casually). But yeah, for those later levels...guh.

    11. Re:If you don't control it it's compromised. by wonkey_monkey · · Score: 1

      I've nearly had perfect scores on multiple occasions

      Exactly. Nearly. Gah!

      --
      systemd is Roko's Basilisk.
  3. We've learned nothing from the past, agreed by Anonymous Coward · · Score: 0

    But are you going to give up on the CONVENIENCE?

  4. First rule... by Anonymous Coward · · Score: 0

    Never trust any input. Validate, validate, validate!

  5. Please don't tempt Apple by dottrap · · Score: 1

    People already think Apple's walled garden and sandboxing go overboard. Remember that legit developers have to pay Apple $99/year just to develop+run an app on their own device. Apple also has a long list of requirements about what your app not allowed to do. I'd really hate to see what they do if they got *serious* about locking down the platform.

    1. Re:Please don't tempt Apple by Anonymous Coward · · Score: 0

      Some people already think Apple's walled garden and sandboxing go overboard

      FTFY

      Remember that legit developers have to pay Apple $99/year just to develop+run an app on their own device

      $99/year is basically zero. My office space costs that much per week. Try getting into PS4 development for $99, see how far you get with that. I'm not sure what makes a developer "legit", but "ability to pay $99/year in license costs" is a pretty low barrier. If you can't surmount that, you're not going to make an app that anyone will use anyway, and if you want to just develop apps for your own use, duh, jailbreak.

    2. Re:Please don't tempt Apple by Anonymous Coward · · Score: 0

      You also need a mac. Still not much compared to a developers salary.

    3. Re:Please don't tempt Apple by tepples · · Score: 1

      Still not much compared to a developers salary.

      In what country? Different countries have different currencies with different exchange rates to the United States dollar. The cost of a Mac and a certificate are based on exchange rate, not purchasing power parity. And I was under the impression that in order to build demonstrable skills, programmers new to iOS had to each buy a Mac and iPad mini and pay for a certificate out of their own respective pockets before they could get hired for the first time.

  6. That way of thinking is wrong... by Anonymous Coward · · Score: 1

    Blocking any form of "hacking" will also hurt legitimate users. For example, being able to install an APK manually, not every devices come with the Google Play store and quite frankly the Amazon appstore is extremely lacking compared to the Play store. So being able to install apk is a life saver.
    Removing similar features will just hurt the userbase even more.

    1. Re:That way of thinking is wrong... by zopper · · Score: 1

      I totally agree. Making a hack-proof client app is (almost) impossible (don't forget that rooted device gives full control of OS to user), and any attempt costs too much in terms of user experience. But still, all the time we see again and again how developers tries "new" ways of DRM and other stuff, and customers can't use their bought apps, because the verification servers came down...

    2. Re:That way of thinking is wrong... by tepples · · Score: 1

      If you want to run an application that is exclusive to Google Play Store, you have two options. The first is to inform the application's publisher that it is leaving money on the table by not also selling on Amazon. The second is to buy a Nexus device, which comes with Google Play Store access.

  7. The most hackable the most popular by Anonymous Coward · · Score: 0

    This is why Windows became so popular, and now Android. Or whatever gaming console has the most piracy atm.

  8. Nothing learned? by Dutch+Gun · · Score: 3, Informative

    On the contrary, mobile devices and hardware are awash in security features. Hardware based chain-of-trust, encrypted storage, signed applications, detailed permissions... these are all lessons learned from their big brother operating systems. Modern mobile OSes are actually far more difficult to maliciously subvert than PC systems, but of course, many of those features mean they're also closed systems, and aren't nearly as flexible. It's definitely a trade off. We see that pretty clearly with Android vs iOS, where iOS has a miniscule amount of malware simply by virtue of being a closed system.

    In terms of game development, I think the focus is more on hacking the client than hacking the OS. As a former MMO dev, the rule was that you really can't trust *anything* the client gives you. Simple as that. It makes development a hell of a lot harder, but time and time again we see new MMOs or multiplayer games (presumably created by inexperienced developers) that break this cardinal rule and get hacked all to hell and back.

    --
    Irony: Agile development has too much intertia to be abandoned now.
    1. Re:Nothing learned? by cfalcon · · Score: 1

      ^ Good post, thank you.

    2. Re:Nothing learned? by Anonymous Coward · · Score: 0

      How does an MMO work around the fact that you can't trust anything coming from the client? Obfuscation?

    3. Re:Nothing learned? by rodrigoandrade · · Score: 1

      The server basically runs all kinds of calculations in real time to make sure everything the client says it's doing is accurate.

      You buy the Shiny Gold Mace of Obliteration for 20,000 gold, client tells that to server, server runs the numbers to make sure you actually have at least 20,000 gold, said mace is available for purchase, the stats on said mace check with whatever is on the game database, etc.

      That's part of the reason some MMOs have chronical lag issues, no matter how low your ping is. If all that overhead is poorly coded, players will experience lag, no way around it.

    4. Re:Nothing learned? by Dutch+Gun · · Score: 2

      I should clarify that statement a bit: nothing related to actual game state from the client can be trusted. In other words, for instance, you wouldn't rely on the client performing hit-detection and telling the server "I just attacked and hit this creature for x damage". Instead, you would only relay the raw input commands (e.g. "I just pressed the command to cast a fireball") from the client to the server, and it's the server that processes all the game logic, then sends the result back to the client as to whether it hit or not, what the effect was, and so on. The client is really just a dumb terminal with fancy graphics and sound fx.

      Of course, the client also has a full set of local collision data and local agent positions, so it can more or less predict what will happen on the server in advance, especially regarding your character, since it obviously knows how you're planning to control before the server does. This is important to reduce the apparent effect of network latency. Otherwise, the game would feel horribly laggy, especially when moving your character around and firing off spells or skills. Client-side prediction is a pretty old technique for networked videogames, but generally has to be uniquely tailored and tuned for each game you make.

      --
      Irony: Agile development has too much intertia to be abandoned now.
    5. Re:Nothing learned? by TranquilVoid · · Score: 1

      Yes, all the fighting calculations are done on the server. The client doesn't get to do the dice roll for how much damage a swing of their golden mace did. However the client will do their own temporary calculations as to whether the mace can swing (target is in range, last swing is complete etc.) and update the graphics to start showing the swing. Generally the server will return with the damage, or whether it was a miss/block, before the graphical swing is complete, and the client can therefore show the result in real time.

      If the server comes back and says, no, your opponent had just moved out of range then the client has to stop it and it looks a bit jerky. A similar thing happens for movement. The client will move your character instantly, but ultimately the server will sync and tell the client the real position. I believe in some games you can take advantage of the server erring on the side of client smoothness (by tolerating lag and therefore giving a little trust to the client) and get your client to cheat by running a few percent faster.

  9. Probably not by Anonymous Coward · · Score: 1

    Complex topic, I would "no" at least in the scope "should you as a developer take significant steps to prevent hacking"

    Consider following:
    1) The whitepaper is from a company selling services for this, they want to paint a grim picture
    2) Like PC with piracy, Android/jailbroken iOS piracy is likely something you can't solve, but it will take a lot of time & money to fight
    3) People downloading pirated games are pretty much lost audience, they were not planning to buy upfront anyhow
    4) Anti-piracy measures can piss off your real customers. This is much bigger risk in mobile where it's really easy to just move along
    5) If you can detect pirated users, feel free to "up the ante" in ads to full page interstitials, etc. ;)

    So, worry about making a good game, follow best practices about validating IAP results, but let Apple & Google worry about securing APIs

  10. OS Level protections = DRM by cfalcon · · Score: 4, Insightful

    We don't need "OS level protections". It's your phone, you control all the code on it. Same as on your PC. Are you really fucking bitching that phones don't have enough fucking DRM? I'm sure glad to give up all my freedoms so some teenager can't cheat in clash of fucking clans.

    1. Re:OS Level protections = DRM by cfalcon · · Score: 3, Interesting

      As a note: a lot of games already try to detect jailbroken iphones and refuse to play. Because OBVIOUSLY, if you are jailbroken, it must be to cheat at their stupid games. That's like refusing to run if your machine has a local admin account, or the root user has a fucking shell attached. Ludicrous.

      Anyone who wants more of this shit hasn't had the first thought on the topic yet.

    2. Re:OS Level protections = DRM by Anonymous Coward · · Score: 0

      Very much seconded. Is it the OS's job to "protect" the game (or whatever app) or to protect me, the user?

      Exactly. Thought so.

      That's why I'll stay very clear of vendor-controlled OSes.

    3. Re:OS Level protections = DRM by Anonymous Coward · · Score: 0, Flamebait

      Because OBVIOUSLY, if you are jailbroken, it must be to cheat at their stupid games

      No. OBVIOUSLY, if you are jailbroken, you are pirating their game. Because JB phones cannot make purchases, but they can run packages from Chinese warez sites. Every app released on iPhone is on those sites within minutes. Developers aren't idiots, and since your phone is obviously jailbroken you know damned well you don't pay for your apps, so take your "wah my pirated apps don't work" rant and fuck off.

    4. Re:OS Level protections = DRM by Anonymous Coward · · Score: 0

      I suppose that you'll be happy when just about everything you "own" is under corporate control, then?

    5. Re: OS Level protections = DRM by Anonymous Coward · · Score: 0

      What about the android equiv of having root? Should I/we fuck off as well? We have access to the app store and can make IAP just like a normal user. I've never pirated anything for my phone but I have BOUGHT a couple games that refused to run on a rooted phone. I don't cheat at mobile games either as thats pretty damn sad. Are you saying you don't want my money cause I have root?

      I only have it because first it allows me to image my device for backups and restores and 2 for security. With root I can control app permissions or have a firewall to filter out bullshit put in by shady devs. Yea you guys aren't all sunshine and rainbows yourselves. Tell Me...what's your studios name so I can avoid them?

    6. Re:OS Level protections = DRM by renderhead · · Score: 3, Informative

      I know this is a troll, but in case anyone is mislead I want to clear up a factual error:
      Jailbroken iPhones absolutely can make purchases from the App Store. I have a history of jailbreaking my phones when they get old to enable certain mods and extensions that are not supported by Apple (for example, I had a notification center on my iPhone before Apple released theirs in iOS 7). It didn't change anything about the way I ran or installed my official App Store apps, and I never downloaded a pirated app.

      --
      I wish that my inferiority complex were as good as yours.

      -RenderHead

    7. Re:OS Level protections = DRM by Anonymous Coward · · Score: 0

      You can run the pirated packages without rooting the phones. No hacking required.

      Getting rid of the carrier's preinstalled crapware, however... yeah, that'll require it.

    8. Re:OS Level protections = DRM by Lumpy · · Score: 1

      And right there is the ONLY real answer we have had on this subject.

      Thank you for being one of the only sane voices on this.

      --
      Do not look at laser with remaining good eye.
    9. Re:OS Level protections = DRM by Anonymous Coward · · Score: 0

      As a jailbreaker, fuck right off. My phone is jailbroken so that I can customize my home screen and add functionality that Apple should have added or allowed to be added in the first place. I've paid for every non-free app I have and I've never downloaded a pirated app. If people are pirating your apps, you're either a shitty developer and nobody would pay 99 cents for your piece of shit app, or you've overpriced your tower-defense clone.

    10. Re:OS Level protections = DRM by Bing+Tsher+E · · Score: 1

      But.. but.. but... the leaderboard. Gotta get toprank. gotta gotta.

    11. Re:OS Level protections = DRM by cfalcon · · Score: 1

      Man, I think the last anything I pirated was X-Wing in the 90s. Then I asked for it for Christmas. But fuck you too.

      I've got a jailbroken iphone, and I've pirated not one goddamned thing. There's a lot of reasons to jailbreak- "the default UI fucks up your background with a goddamned gradient .png file" was my breaking point, but there's others. None of them are piracy. You think things are piracy because you have a filter on, and you think people should be shackled to the whims of developers on the hardware they bought and paid for. Not your hardware. Not your CPU. Theirs.

      So YOU fuck right off, you generalizing goddamned idiot. I say something "high and mighty" because I'm goddamned CORRECT. You don't own my phone, I don't break any laws, and your digital vigilanteeism, inability to handle your own failures at developing (the whole industry blames piracy as if a bunch of broke-ass teens trying to impress their friends were all gonna turn into megasales if only you wrote shittier and more fucked up DRM bullshit), instant ability to generalize me totally incorrectly,combined with a 100% selfcertainty are just going to end up with even more shitty content and more fed up users.

    12. Re:OS Level protections = DRM by Anonymous Coward · · Score: 0

      Please, complete your rant by telling us the name of your studio. You want people to fuck off? Fine! Help us do that by letting us know which dipshit to avoid.

    13. Re:OS Level protections = DRM by phorm · · Score: 1

      Because OBVIOUSLY, if you are jail-broken, it must be to cheat at their stupid games

      No, it's more that if you have a jail-broken device, you may be using an illegitimate/copied version of the software (or movie, or whatever). Getting paid apps for "free" was actually one of the big reasons for the popularity of jailbreaks on early iPhones.

    14. Re:OS Level protections = DRM by Anonymous Coward · · Score: 0

      I have never pirated a thing on iPhone - I don't even have one.

      However, this gives me a rather big incentive to practice the former (and encourage others to do so), and to obtain the latter. Your product relies on "features" that are seriously damaging to individual rights and have considerable and dangerous long-term implications for freedom of speech, innovation and innumerable other important subjects. I am not going to bother dumping a lengthy debate here since you won't read it anyway, but I do know that society is better off if you and your kind are deprived of any sort of economic power.

      You, sir or ma'am, fuck off yourself. Your pocketbook is not more important than the right to control one's own property. Like many, you are leeching off of good faith legal provisions that impose an unnatural monopoly on reproduction of your wares and using them to justify the loss of that control. You, your attitude, and those who share in it are profoundly dangerous, and the fewer of you in society and less power you have, the better.

    15. Re:OS Level protections = DRM by cfalcon · · Score: 1

      Irrelevant though. Whether a developer wants to point at the bogeyman of piracy or the bogeyman of cheaters, it's still my phone. The fact that I *could* be a pirate because I have root doesn't mean shit, and anyone who thinks that needs technical discouragement (mostly present), but possibly even legal discouragement as well. Ideally, we'd lose the idea of rootless phones entirely, but the model has been really helpful for its actual only good purpose- noob level users not getting ownfaced like they do in Windoze.

    16. Re:OS Level protections = DRM by phorm · · Score: 1

      I didn't say I agree with it, I was just stating the mentality behind it. Personally, I find it retarded that various ports of SINGLE-PLAYER, previously DRM-FREE games - e.g. Final Fantasy series etc - have to do a phone-home check before you can run them on an Android/iDevice.

      The dumbest part is that one of the first thing that happens when a pirate version of the game comes out is that all the stupid DRM shit is stripped off anyways, giving the pirates a better copy than those that legitimately purchased it.

      In the cases of some PC games, the DRM has been known to make the game crash, or even break systems. I seem to recall that there were various cases of Starforce/SecuROM breaking optical drives, for example.

  11. Very easy really by Anonymous Coward · · Score: 0

    Didn't read the article.

    I use a free and very useful and free program called "x-plore", I download an .APK, point x-plore to it and it's installed. Painless. X-plore has two abilities related to an .APK file open it as a zip file or install it.

    1. Re:Very easy really by Anonymous Coward · · Score: 0

      Did I mention it's free :)

  12. The paper is marketing bull by nomaddamon · · Score: 3, Interesting

    Most of the advises given (if not all) are ineffective and in some cases make things worse.

    Code and data obfuscation only provides false sense of security (and a large paycheck for your "security" vendor) - If i have access to binaries, have root OS access and skills to de-compile the app, obfuscation/encryption (with local key) is only a small nuisance (compared to skill required for decompilation/repackaging/on-the-fly modification)

    Moving data to server-side provides a simpler attack-vector - i can MTM the (hopefully) secure connection and alter data sent to app - i don't even have to decompile the app to hack it

    On-the-fly binary validation does not work (again, if i have OS level access) - i can disable/fake it.

    The numbers in the paper are classic marketing bull - when are you more likely to buy an 99$ in-app purchase?
    - if you can do it for free (Apple MTM bug)
    - if you actually have to pay for it

    TLDR:
    You can't protect against hacking/repackaging if the hacker has access to binaries and root.
    You can't protect against data modification if the hacker can install hes own CA on the device.

    1. Re:The paper is marketing bull by Anonymous Coward · · Score: 0

      Who expects quality from a UBM conference?

  13. Total hax, man. by Anonymous Coward · · Score: 0

    Just don't call your game "the gibson". That is all.

  14. Take a page from the China mobile game scene by Anonymous Coward · · Score: 0, Interesting

    Piracy in China is rampant, one of the worst in the world but the development scene for Chinese mobile game is booming

    Game developers, in fact, all app developers can learn how the Chinese app developers are doing ---

    1. They expect their app to be pirated

    Not only they expect it, they hope people would pirate their app the more the better

    2. Chinese app / mobile game developers do not make game to sell

    All their games / app are free. Free to download, free to copy, free to pirate, and they do not place limit on their games / app - whatever game downloaded is the *FULL* version, no crippleware

    Instead, the Chiense app / game developers earn money from in-game purchases, and they are raking boatloads of $$$ from it

    1. Re: Take a page from the China mobile game scene by MenThal · · Score: 3, Insightful

      You can't pirate free apps. The question for these become; how rampant is piracy or hacking for getting the in-game stuff for free.

    2. Re: Take a page from the China mobile game scene by Anonymous Coward · · Score: 0

      They don't ask that question because they don't have to care about that. There are plenty of idiots that will spend thousands on a game just to get ahead.

      For example, while working on plumbing on a $2M+ house in West Palm Beach, my brother noticed that the owner was playing Clash of Clans. They got to talking, and the moron told my brother that he'd spent somewhere around $18000 upgrading his castle.

    3. Re:Take a page from the China mobile game scene by Anonymous Coward · · Score: 0

      Instead, the Chiense app / game developers earn money from in-game purchases, and they are raking boatloads of $$$ from it

      Yep, because they can't make money the old fashioned way by selling complete games because of piracy.

      Really, the pirates brought the plague of free-to-play games and online-only games upon themselves. What did you expect studios and publishers to do? Sit on their asses and continue to effectively hand out copies their games for free?

    4. Re: Take a page from the China mobile game scene by Nyder · · Score: 1

      You can't pirate free apps. The question for these become; how rampant is piracy or hacking for getting the in-game stuff for free.

      If you put out an app, it will get hacked. It has been this way since the 70's. Nothing has fucking changed, 'cept the Twenty somethings that do NOT know computer history at all and thinks everything is new.

      If you are a developer, the app you put out will be hacked. Always has been, always will be, nothing will change that. The question is, as the developer and knowing your app will be hack, how do you respond? Do you then fuck over your paying customers by putting in draconian DRM, or do you make a program that rocks because you know the word of mouth is probably your best review system?

      The choice is up to you, the developer. Do you harvest good will with your customers, or do you be a EA/Ubisoft and shit on your customers?

      --
      Be seeing you...
    5. Re: Take a page from the China mobile game scene by mlts · · Score: 1

      Only problem with that logic is that EA and Ubisoft are quite successful right now, which only sets an example that extreme DRM, DLC, and releasing only a few hours worth of content and calling it a game is the way to earn money in the industry. Especially with consoles where there is a 0% piracy rate and the game developers control everything on that platform.

      Of course, it would be nice to see another ID or Bioware. I'm sure there is money to be made on games with a long tail like Neverwinter Nights and NWN2 [1]. However, there just doesn't seem to be an interest to push in that direction. It seems that almost all newer games either fall into the bottomless pit of F2P-P2W or are part a mediocre sequel in a franchise. Even the SimCity app on the phone was all about IAP in order to make your city not suck.

      [1]: Ignore the NWN OC... IMHO, that was more of a demo of what one can do with the toolkit than something playable.

  15. Hello by Anonymous Coward · · Score: 0

    My name is Bunzi Hatata and I'm a Nigerian Prince who needs your help bringing jailbreaks to African phones.

    Please yadayadayada.

  16. Thank you ! by Anonymous Coward · · Score: 0

    Calm down. OP is obviously trolling.

    Hint: When a low 6-digit UID (243066) makes its first-ever post at least 10+ years after the account was created, you know to suspect foul play. Suspicions are confirmed when the post hits all the /. buttons about privacy and security with blatant disregard for logic.

    Great find !! THANK YOU !!!

    As a frequent submitter I am way beyond surprised that the 'Origen' account's first submission (in fact, first of anything in /. after registration more than 10 years ago) was accepted !

    Something really fishy is going on

    TFA most likely is a click bait --- and the "Origen" most likely is one of the many 'reserved' accounts in which only the admins (or the moderator) could use

    Thanks again !!

  17. newbie by Anonymous Coward · · Score: 0

    People really don't realize how much code is use to produce a product, how much code is used to admin the code, how much code is use to admin people, is such amount of code that there is no financial, human and technical resources to any software company deal with all kinds of threats that user might be exposed with "a simple piece of software". Now Im getting used to say that apocalipse will happen cause U.S. president won't be able to login nuke system cause its far beyond a single human can do, its just a metaphora, but I think you get the point. Now imagine in a hundred of years, there will be such amount of code that not even a bot smarter than a human will handle that.

  18. Candy Crush Saga by Anonymous Coward · · Score: 1

    Ever hear of Candy Crush Saga?

    Ever hear of CandySwipe? That's the game that came out 2 years BEFORE Candy Crush Saga (http://www.snopes.com/politics/business/candycrush.asp).

    Of course, it continues to boil down to being clones / copies of earlier games (Bejewelled for example).

    Artwork, design, music, sounds, ideas, most (if not all) are being stolen like crazy in the mobile market. If you don't have a thick skin, don't get into it. Chances are, you spend months, if not years, crafting a beautiful game and release it at $0.99 in the store to only find a cheap copy of it in less than a week on the F2P model from some backwoods out of country developer.

    Are you planning on using a service like FGL.com to find sponsors? They offer help and a better community on how to protect your game.

    1. Re:Candy Crush Saga by Bing+Tsher+E · · Score: 1

      I tried Candy Crush Saga.

      It was so toploaded in derivative bullshit that had nothing to do with the core matching game that I pitched it. It was taking forever to actually get to the gameplay.

      I found a simple clone that just had the actual matching game. It's fun. There isn't bullshit and animated NPC cutscenes (on a matching game. on a phone!) to deal with before you can play.

  19. simple solution by slashmydots · · Score: 1

    This is always been the solution, even after such massive failures as the Valve Anti-Cheat System on PCs. Have the game analyze the size, name, and even hash of all its files when it opens. If they're different than a preapproved list that's loaded into memory for milliseconds after being unencrypted with an enormous hard-wired password, refuse to open the game. That's moderately secure, assuming they can't get to the hard wired password.

    1. Re:simple solution by BradleyUffner · · Score: 1

      This is always been the solution, even after such massive failures as the Valve Anti-Cheat System on PCs. Have the game analyze the size, name, and even hash of all its files when it opens. If they're different than a preapproved list that's loaded into memory for milliseconds after being unencrypted with an enormous hard-wired password, refuse to open the game. That's moderately secure, assuming they can't get to the hard wired password.

      How do you trust that the user hasn't modified "the game" to make it think the hashes always pass?

    2. Re:simple solution by tepples · · Score: 1

      Would "all its files" include third-party video drivers that may be modified for wall hacking, third-party pointing device drivers that may be modified for aim assist, and the like?

    3. Re:simple solution by slashmydots · · Score: 1

      No, that'd be a separate blacklist system. It's not like 1000 people are modding the files in 1000 ways. There's one jackass out there letting people download modified files. In other words, check for the specifically modded file in the specific Nvidia and AMD driver folders and THEN refuse to launch the game.

  20. It's just games by Anonymous Coward · · Score: 0

    It's not that serious.

  21. Watch this Defcon video and think twice by Anonymous Coward · · Score: 0

    Your game will be compromised, it's up to you how you control how that affects other people.

  22. Submit the replay file by tepples · · Score: 1

    Have the client record input log during gameplay and submit it to the server once the game completes, then replay it on the server when verifying a submitted score. If you really want to block an offline tool-assisted speedrun, require the client to submit a piece of the input log every five seconds or so.

  23. Achievements by tepples · · Score: 1

    If it's single player, don't bother.

    On some popular video game platforms, no major single-player game is truly single-player. For a decade, it has become a race among friends to get the achievements first.

    1. Re:Achievements by Anonymous Coward · · Score: 0

      You and your friends are fucking retarded if you care about single player accomplishments

    2. Re:Achievements by rioki · · Score: 1

      +1

      Achievement unlocked: Completed the hamster wheel.

  24. i really hate all you idiots by Anonymous Coward · · Score: 0

    "Have we learned nothing from the pains of the past?"

    have you learned nothing about handheld battery life?

  25. It's good you missed it - it was an advertisement by Vokkyt · · Score: 1

    Reading the whitepaper, the whole thing seems like it's focused on promoting Arxan's services. It's entirely possible that the presentation itself took a different tone/direction, but the whitepaper itself was fairly contentless sprinkled with a few good points about older MITM attacks exploiting the In-App purchases for iOS and the high piracy rates on Android in China and Russia.

    Really that last part is the thrust of the article -- high piracy rates for which they don't really offer any solution except DRM and always-online games. (To their credit, they do make the recommendation of "some sort of protection on the networking layer, in-memory layer, and on disk layer...as well as portions dealing with receiving and unpacking the player's saved game or state.")

    Everything else was either misleading, fairly obvious non-suggestions, or just plain outdated information.

    Examples:

    - Whitepaper dedicates a section to lost revenue from a MITM attack allowing iOS users to get in-app purchases for free. The reference they use is a 2012 article from the Guardian talking about how Apple already fixed it. Specifically, this was relating to iOS 5 and has since been resolved. While Jailbreak options still exist, the whitepaper does not mention these nor does it discuss any other actual leak.Referenced Article

    - Whitepaper has section on Flappybird clones which reads:

    ...However, by March 2014, approximately 60 Flappy Bird clones a day were being added to the iOS App Store...Worst of all -- a reported 79% of these clones contained malware.

    This section has a reference that points to a McAfee threat report from June 2014 - as the section reads, "these" refers to the clones on the iOS App Store, however, the McAfee report clearly shows that this is Android stores that are plagued, not iOS. http://www.mcafee.com/us/resou... Page 6

    - Whitepaper has a section on how hackers damage communities, which is not incorrect, however, they provide the following "helpful" tips:

    • Learn how to tell when a hacker hacks
    • Include banning as a feature
    • Look for reports of hacking

    While these are not bad suggestions, they're also absolutely common sense for mobile game developers, or just people dealing with problems in general.

    The submitter is absolutely right that this could have been a really keen presentation, but based on what they produced in the whitepaper, it sounds like a business trying to drum up some more business for themselves with misleading and/or useless information.

  26. Have we learned nothing? by DougPaulson · · Score: 1

    "As a developer contemplating trying out the mobile game scene, a GDC session about hacking/tampering looked interesting .. Have we learned nothing from the pains of the past?"

    I would ask anyone in developing connected devices. What happened the last time you tried to hack your own device? And if the answer is you haven't even tried then most definitely you've learned nothing about security. If the underlying OS can't prevent hackers walking all over your memory then it's GAME OVER ...

  27. They handled it well in Simpsons tapped out by GuB-42 · · Score: 2

    In Simpsons tapped out, a typical time-waster of a moblie game, free with premium content, players found an exploitable bug allowing them what is basically infinite money. IIRC they handled it this way :
    - they fixed the bug
    - they referred to the hack an in-game event (the moral being of course : you won't get any fun by hacking)
    - they gave a special item to everyone that didn't use the exploit
    - they didn't penalize those who did (except by not giving them the special item)

    I found it was a wonderful way to handle the situation : they didn't punish the hackers, they simply told that the non-hackers were way cooler.

  28. Your game will be hacked. by Anonymous Coward · · Score: 0

    Your game will be hacked and pirated, even if it is free. The more successful your game, the quicker the hacks will appear and the more sophisticated they will be.

    Currently, the only effective counter measures are through social networking effects e.g. League Of Legends, Twitter, Facebook.

    Expect it, plan for it, then repeat after me:

    "The only thing worse than a potential customer pirating your software is a potential customer pirating your competitor's software."

  29. If you're surprised security is crap by Anonymous Coward · · Score: 0

    you haven't learned from history, either.

  30. Have we learned nothing from pains of the past? by Anonymous Coward · · Score: 0

    Some people have, yes. Most people have not, however.

    The problem is that nothing is actually secure-by-default - it has to be designed with security in mind from the very start. Every OS has lots of supporting technologies available to assist in building a secure system but unless the designers and developers actually use those tools then the end-result will be a festering pile of insecure crap. And some software authors intentionally bypass security because "it's easier" or "it gets in the way."

    Example: without any knowledge or input from the development or security staff at a company I've worked for a particular "operations" person started writing desktop utilities for staff use so that they could bypass the main software of the company to do things "more efficiently." Problem is that these utilities used direct connections to the backing database bypassing the public API completely ... and stored the plaintext "sa" password in their .config files to do so. How fucking brain dead is that?

  31. The real problem by Anonymous Coward · · Score: 1

    For an indie developer, the real problem is that almost nobody can get a significant number of players in such an over-crowded, competitive marketplace unless they have a hugely popular brand (famous movie, famous developer, famous game company, something), or millions of dollars in marketing money.

    Given that your indie title with no marketing "oomph" behind it is 99.999% likely to not get a large number of players or make significant money, fixing any potential security problems in it is almost always going to be a waste of your time. Unless you're just doing this hobby to learn game security programming. If you're doing this hobby to learn fun gameplay programming, physics engines, client server coding, etc. don't worry about the security piece too much. (If you want to learn EVERY detail of game programming from your hobby, sure, learn security too.)

  32. Jackass will do the polymorphic shuffle by tepples · · Score: 1

    It's not like 1000 people are modding the files in 1000 ways.

    Yet.

    Virus authors figured out polymorphic code long ago. Now imagine one jackass making a program that shuffles the order of blocks of code in the hack so that you have 1000 files all different but with identical behavior. Thus blacklisting fails for wallhack and aimbot detection the same way it has been shown to fail for virus detection.